Tag archive
Two severe vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution across versions dating back to PHP 5.4
PHP released emergency updates for two high-severity vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, impacting PHP-FPM, Apache mod_php, php
PHP scheduled an out-of-cycle security release to address two remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Offici
CVE-2026-110447 lets attackers run commands on Nextcloud servers with the built-in CODE app. How to check, update or remove it and look for web shells.
Two critical PHP flaws, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35: what to do on Plesk, Synology, shared hosting, Docker and your own servers.
Arista detailed a zero-day vulnerability in VeloCloud Orchestrator (CVE-2026-114625, CVSS 9.9) where a read-only account can elevate to operator privileges
Explore the impact of PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting PHP 7.x and 8.x releases. With a CVSS score of 9.2 allowing pr
No PHP update yet on Synology? Three php.ini settings shrink the PHP2Shell attack surface — step by step for Web Station, Plesk and your own servers.
NGINX fix in 1.30.6 and 1.31.7 (Plus 37.1.0.1, 37.0.5.1): which configurations are affected, how to check them and how to update containers.
China-linked threat group Armory Castle targeted BeyondTrust Remote Support using an undisclosed vulnerability tracked as CVE-2026-102764. The 9.3-severity
NGINX versions 1.30.6 and 1.31.7 patch five vulnerabilities, including a long-standing flaw present in every release since May 2005. The release covers thr
Ahsay Backup has released updated hotfixes for AhsayCBS addressing CVE-2026-105133 and CVE-2026-105134, following verification that previous August patches